Pressure differential system

ABSTRACT

In a cabin pressure control system utilizing dual controllers, one of which is in primary control of cabin pressure and the other of which is standby, external pressure and cabin pressure are monitored. If the difference exceeds a predetermined safe value, the rate of change of cabin pressure is incremented based on the excess. Also, switching of control from the primary to secondary controller, as would occur upon malfunction, is prevented.

BACKGROUND OF THE INVENTION

(1) Field of the Invention

In modern aircraft, cruising elevations of 35,000 ft. or greater are notuncommon. While the atmospheric pressure outside the aircraft becomesvery low at such altitude, it is required that the pressure inside theaircraft cabin remain as near sea level pressure as possible to provideadequate oxygen for the passengers. However, if cabin pressure is notpermitted to decrease, the pressure difference between inside cabinpressure and outside ambient pressure can become sufficiently great athigh altitude to cause a catastrophic rupturing of the aircraft.Accordingly, it has been standard practice to permit cabin pressure todecrease to a value corresponding to an altitude of about 8,000 ft.Thus, structural integrity of the aircraft can be maintained whileproviding adequate oxygen for passenger breathing.

This variation in cabin pressure must be accomplished withoutsacrificing passenger comfort. Since the human ear is more sensitive toincreases in pressure (descent in elevation) than to decreases inpressure (ascent in elevation), the passenger comfort factor iscomplicated by the need for different permissible maximum change rates,for use in each phase of operation. Furthermore, for maximum passengercomfort the cabin pressure should not be subject to pressure spikes orchanges when the aircraft momentarily climbs or drops in altitude.

(2) Prior Art

The importance of cabin pressure control when viewed in light ofpassenger comfort and safety has imposed a great burden on the flightcrew work load. This burden is ever increasing while the presenttendency is to reduce the size of the flight crew. For these reasons,methods of automatic cabin pressure control have been developed whichrequire minimum work by the flight crew. However, these prior artautomatic cabin pressure control systems are known to have significantdeficiencies. Although flight crew work load is greatly reduced, theattention of one member of the flight crew periodically must be focusedon the cabin altimeter to clock the rate of cabin pressure change or tocompare it with the aircraft altimeter to be assured that a singleautomatic cabin pressure controller is functioning properly. Also,automatic controllers in general will compute a rate of cabin pressurechange which is a function of the differential between existing cabinpressure and its final value or the existing aircraft altitude and itsfinal value. Previously chosen references upon which the rate of cabinpressure was based resulted in a rate of change which was subject toinstantaeous rapid changes when the aircraft altitude would changerapidly due to air pockets or foul weather. Examples of this prior typeof automatic cabin pressure controller are found in U.S. Pat. No.3,473,460 to F. R. Emmons and U.S. Pat. No. 3,461,790 to R. C. Kinsell.

SUMMARY OF THE INVENTION

The present invention obviates these and other deficiencies of prior artcontrol systems. The continual or intermittent observation of the cabinaltimeter is eliminated by the use of dual automatic controllers. Onecontroller is designated "primary" and performs the cabin pressurecontrol functions while the other controller is designated "standby" andmonitors the performance of the primary controller. The controllers arecontinually and automatically monitored to detect whether bothcontrollers are either simultaneously on or simultaneously off and asystem is incorporated to prevent such a situation. The standbycontroller monitors the actual rate of change of cabin pressure andcompares it with a preselected rate of change limit. If the actual rateof change of cabin pressure substantially exceeds the preselected rateof change limit, a switch-over signal is initiated and the standbycontroller shuts off the primary controller and takes command of thecabin pressure control. This switch-over, however, is blocked if theexcess rate of change is caused by insufficient air inflow rather than acontroller defect. Automatic transfer of control from primary to standbyis also blocked when the excess rate of cabin pressure change is due tothe pilot causing the aircraft to climb at a rate greater than that uponwhich the preselected cabin pressure change rate was based.Simultaneously, the preselected rate of change is incremented by apredetermined amount to permit a more rapid climb in cabin altitude andthereby maintain a safe differential pressure between outside ambientpressure and inside cabin pressure.

The primary and standby controllers are completely identical andtherefore interchangeable and they actually alternate roles onsuccessive flights so that the cabin pressure control capability of eachunit can be regularly verified. Each controller has a light which whenon, indicates to the controller that it is the primary for that flight.If control should be switched from primary to standby due to a detectedmalfunction of the primary controller, or its associated selector ordrive motor, the automatic successive flight switching function will beblocked so that the light on the primary controller for the last flightremains illuminated. This enables the maintenance crew to readilydetermine which of the identical controllers or associated componentsrequires repair.

The present invention obviates the second enumerated prior artdeficiency by controlling the cabin pressure as a function of sensedatmospheric pressure only. The cabin pressure approximately follows thecurve P_(c) =a/(1+b/P_(a)) where P_(c) is the cabin absolute pressure,P_(a) is the ambient atmosphere absolute pressure and a and b areconstants. This relation is independent of aircraft cruising altitude.By proper selection of the constants a and b, an essentially linearfunction is produced. This function permits P_(c) to track P_(a),reaching their permitted minimum values together, but still preventsP_(c) from being extremely sensitive to minor rapid changes in P_(a).

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a dual automatic cabin pressure controlsystem of this invention;

FIG. 2 is a block diagram of one of the dual automatic controllers ofFIG. 1;

FIG. 3 is a block diagram of ΔP limit logic for use in the controller ofFIG. 2;

FIG. 4 is a graph of rate increment vs. differential pressure for amaximum ΔP amplifier of FIG. 3;

FIG. 5 is a schematic diagram of a cabin altitude function generator forthe controller of FIG. 2;

FIG. 6 is a series of graphs labeled 6A-6C showing voltage/timerelationships for the cabin altitude function generator of FIG. 5;

FIG. 7A is a graph of cabin pressure vs. ambient pressure for thecontroller of FIG. 2;

FIG. 7B is a graph of cabin pressure vs. ambient pressure for a priorart controller;

FIG. 8 is a block diagram of automatic transfer circuit of FIG. 1;

FIG. 9 is a logic diagram of a malfunction detection logic of FIG. 8;

FIG. 10 is a logic diagram of a successive flight transfer of FIG. 8;

FIG. 11 is a logic diagram of an on-off control interconnect showing theinterconnect logic for the system of FIG. 8; and

FIG. 12 is a plan view of a cabin pressure selector panel suitable forthe system of the present invention.

DESCRIPTION OF THE PREFERRED EMBODIMENT

FIG. 1 illustrates a dual automatic cabin pressure control systemembodying the present invention. A selector panel 10 (see also FIG. 12)is manually controlled to produce output voltages corresponding to thelanding altitude, set by a selector knob 4, landing field barometricpressure correction, set by a selector knob 5, and a selected limit ofthe rate of cabin pressure change, set by a selector knob 6. Thesevoltages are transmitted through conductors 12 and 14 to identicalautomatic cabin pressure controllers 16 and 17, respectively.

The cabin pressure selector 10 may include dual sets of selectorpotentiometers driven by the selector knobs 4, 5, and 6, one for cabinpressure controller 16 and one for cabin pressure controller 17. Thesedual sets of potentiometers would preferably be ganged together so thatthe command voltages for both controllers are the same. Controllers 16and 17 are connected through conductors 18 and 19, respectively, to anactuator 20 which controls opening and closing of an outflow valve (notshown).

Each of the controllers 16 and 17 preferably operates a separate outflowvalve motor in the actuator 20 with only the mechanical valve linkageand reduction gears in common. Each controller has its own power supply,sensor units, electronic logic and control circuits (illustrated in FIG.2) so that they operate completely independent of each other, minimizingthe possibility that both controllers could be disabled at the sametime.

Controller 16 receives an input voltage proportional to ambientatmospheric pressure from an atmosphere pressure sensor 21 throughconductor 22 and an input voltage proportional to cabin pressure from acabin pressure sensor 23 through conductor 24. Controller 17 receivescorresponding input voltages from an atmosphere pressure sensor 26through conductor 28 and from cabin pressure sensor 29 through conductor30. Pressure sensors 21, 23, 26 and 29 may be any suitable pressuretransducers which produce a detectable change in output responsive tochanges in pressure. An automatic transfer circuit 32 receives inputsfrom automatic cabin pressure controller 17 through conductor 33, fromautomatic transfer circuit 34 through conductor 36 and from selectorpanel 10 through conductor 37. Automatic transfer circuit 32 is alsoconnected to automatic cabin pressure controller 16 through operation ofa relay (illustrated schematically as conductor 38), to actuator 20through conductor 39 and to automatic transfer circuit 34 throughconductor 40. Automatic transfer circuit 34 receives an input fromactuator 20 through conductor 41, from automatic cabin pressurecontroller 16 through conductor 42, and from selector panel 10 throughconductor 43 and sends an input to automatic cabin pressure controller17 through operation of a relay (illustrated schematically as conductor44).

Each automatic transfer circuit is associated with and controls one ofthe automatic cabin pressure controllers. Automatic transfer circuit 32is associated with automatic cabin pressure controller 16 and automatictransfer circuit 34 is associated with automatic cabin pressurecontroller 17. Automatic cabin pressure controllers 16 and 17 andautomatic transfer circuits 32 and 34 also receive inputs from a landinggear switch 46 through conductors 48, 50, 52 and 54, respectively, andfrom a throttle switch 56 through conductors 58, 60, 62 and 64,respectively, the purposes for which will be subsequently described indetail.

During each flight, on an alternating basis, one controller functions asthe primary controller and the other serves as the standby controller.The primary controller is in actual control of the cabin pressurethroughout the flight. In the course of the flight, the standbycontroller monitors the performance of the primary controller. If theprimary controller should malfunction, the standby controller will takeover control of cabin pressure. If no malfunction occurs, identity ofthe primary controller is transferred upon landing for the next flight.This automatic transfer of the primary mode between controllers onsuccessive flights enables each controller of the dual automatic controlsystem to automatically check the other on a regular basis to providemaximum reliability for the entire system. Each of the cabin pressurecontrollers utilizes the input voltages from its correspondingatmosphere pressure sensor to compute a desired corresponding cabinpressure. This is compared to the voltage corresponding to cabinpressure from the cabin pressure sensor to generate an error signalutilized by the primary controller to control the position of theactuator 20.

Referring now to FIG. 2, the automatic cabin pressure controller 16 andassociated components are illustrated in detail, it being understoodthat controller 17 (FIG. 1) has an identical set of components similarlyconnected.

The conductor 12 connecting the selector panel 10 to the controller 16comprises a conductor 12a which connects the potentiometer of the "ratelimit" selector 6 of the selector panel (FIG. 12) to a rate logiccircuit 66 of the controller. A conductor 12b connects selectors 4 and 5for landing field altitude and barometric pressure of the selector panel10 to a high altitude discriminator circuit 68. A conductor 12c connectsthe selector panel 10 to a power supply 70 in the controller 16 whichprovides operating voltage for the selector panel 10. The power supply70 is also connected by a conductor 42a to a power loss detector circuitwhich will be subsequently described in connection with FIG. 9.

The rate logic circuit 66 receives additional input from a cabinaltitude function generator 72 through a conductor 74, from a descentdetector circuit 76 through a conductor 78, and from the cabin pressuresensor 23 through a conductor 24a. The cabin pressure sensor 23 alsoprovides its voltage signal through a conductor 24b to a ΔP limit logiccircuit 80. This signal is also conveyed by a conductor 24c to a rateamplifier 90 and by a conductor 42b to a malfunction detection logiccircuit which will be described in connection with FIG. 9, and todynamic compensator 100 by conductor 24d.

Connection of the atmosphere pressure sensor 21 to the controller 16 isby a conductor 22a to the cabin altitude function generator 72, via aconductor 22b to the descent detector 76, and by a conductor 22c to theΔP limit logic circuit 80. The cabin altitude function generator 72 isalso connected by a conductor 84 to the descent detector 76 and by aconductor 86 to the high altitude discriminator 68 which is in turnconnected by a conductor 88 to the rate amplifier circuit 90. The ΔPlimit logic circuit 80 is also connected to the rate logic circuit 66 bya conductor 92 and connected by a conductor 42c to the malfunctiondetection logic circuit of FIG. 9.

A ground logic circuit 94 in the controller 16 receives a DC inputsignal from a source of direct current voltage 96 by parallel pathsthrough the landing gear switch 46 via conductor 48 and through thethrottle switch 56 via conductor 58. Output from the ground logiccircuit 94 is provided to the descent detector circuit 76 throughconductor 98 then to a dynamic compensator circuit 100 through aconductor 102, and to driver 110 through conductor 103.

The output produced by the rate logic circuit 66 is transmitted throughconductor 104 to the rate amplifier 90 which produces a correspondingoutput which is transmitted to the dynamic compensator 100 via conductor106. The resulting controller output is transmitted from the dynamiccompensator 100 through the conductor 108 to a driver circuit 110 of theactuator 20. The driver circuit 110 is connected in a feedback loopcomprising conductor 112, contact 114c of switch 114 (see FIG. 8), motor116, conductor 118, tachometer 120, and conductor 122 for controllingoperation of the motor 116. Operation of the motor 116 controlsoperation of the outflow valve (not shown) to which it is coupledthrough a gearbox 126 and magnetic clutch 128. The clutch 128 isselectively controlled between its engaged and disengaged positions by adirect current voltage which is supplied from the DC source 96 through amanual/automatic selector switch 130 and conductor 132 to the actuatingwinding 134 of the clutch.

The position of contact 114c determines whether the controller is inactual control of the cabin pressure rate of change. The entirecontroller is functioning whether it is operating in the primary orstandby mode. The difference is that when the controller is primary andno malfunction has been detected, it will be in control of the cabinpressure change rate due to its contact 114c being closed. The standbycontroller will be functioning but not controlling the cabin pressurebecause its corresponding switch is open. When a malfunction is detectedor the standby controller is selected manually, the controller willcontrol the cabin pressure even though it is operating in the standbymode.

In operation, the automatic cabin pressure controller 16 utilizesmanually selected inputs from the selector panel 10 and inputscorresponding to ambient atmospheric pressure and cabin pressure fromthe sensors 21 and 23, respectively, to produce an output voltage forcontrolling position of the outflow valve (not shown).

The cabin altitude function generator 72, which will be subsequentlydescribed in detail in connection with FIG. 5, receives an input voltagefrom the atmospheric pressure sensor 21 through conductor 22a which isproportional to ambient atmospheric pressure outside the airplane andutilizes this voltage to compute an output voltage corresponding to acalculated value of cabin pressure. The functional relationshipestablished by the cabin altitude function generator 72 automaticallyprovides a corresponding cabin altitude for every possible aircraftaltitude so that no manual selection of cruise altitude by the crew isnecessary to effect a proper rate of cabin pressure change, it beingunderstood that the maximum permissible cabin altitude (generally 8,000ft.) is established at the maximum design altitude for the airplane.This output voltage is altered during descent by a positive DC voltagefrom descent detector 76.

The descent detector 76 receives the ambient pressure responsive voltagefrom the atmosphere pressure sensor 21 through conductor 22b andutilizes this voltage to determine when the airplane has begun its finaldescent in preparation for landing. In the preferred embodiment, this isdetermined to be when the airplane has descended at a rate of at least1,000 ft. per minute for a period of one minute. When such has beendetermined, the descent detector 76 transmits an output voltage to therate logic 66 through conductor 78, which causes the output to be atfull value. This output will be maintained at this level regardless ofsubsequent changes in the airplane's mode of flight until the airplanehas landed, whereupon the ground logic circuit 94 will transmit aresetting signal through conductor 98 to the descent detector 76 inresponse to closing of the landing gear switch 46.

The positive output voltage of cabin altitude function generator 72 istransmitted through conductor 74 to the rate logic 66 wherein it isadded to a negative input voltage proportional to actual cabin pressure,which voltage is received from cabin pressure sensor 23 throughconductor 24a. The result of this addition indicates whether theaircraft is ascending or whether it is in the dwell function. If thedifference between the actual cabin pressure and the commanded cabinpressure is great, the aircraft is ascending; if the difference is smallthe aircraft is in the dwell function. Accordingly, if the output of thecabin altitude function generator 72 is sufficiently greater than theoutput of the cabin pressure sensor 23 so as to indicate that theairplane is in a scheduled climb, the rate logic will produce an outputthrough the conductor 104 which is at a first predetermined level,preferably 100% of the input voltage from conductor 12a. If less thanthis predetermined difference exists, the rate limit will be scaled tolesser value, preferably about 50% of the rate limit input. The ratelogic 66 is able to determine whether or not the aircraft is descendingthrough a signal from descent detector 76 through conductor 78 which istrue when the aircraft is descending and false otherwise.

From the selector panel 10, the rate logic 66 receives an input voltagethrough conductor 12a which corresponds to a manually selected limit ofrate of cabin pressure change or "rate limit". In the preferredembodiment rate logic 66 has two possible outputs, either 100% of theinput it receives from selector panel 10 or 50% of the input it receivesfrom selector panel 10. If on the basis of the information that itreceives from the sum of the actual cabin pressure and the commandedcabin pressure or from descent detector it determines that the aircraftis either ascending or descending it will pass 100% of the input valueof rate limit. If rate logic 66 determines that the aircraft is in thedwell function, it will only pass 50% of the rate limit input fromselector panel 10.

The output of rate logic 66 is passed to rate amplifier 90 throughconductor 104 to determine at what level rate amplifier 90 willsaturate. At a summing node of rate amplifier 90 the output of highaltitude discriminator 68 through conductor 88 and the output of cabinpressure sensor 23 through conductor 24c are combined to supply theamplification input.

The selector panel 10 provides an output voltage through conductor 12bto the high altitude discriminator 68 which corresponds to thepreselected landing field altitude, corrected for barometric pressure.Also fed to the high altitude discriminator is the output of the cabinaltitude function generator 72 which is proportional to the calculatedcabin altitude, i.e. the altitude to which the controller 16 shouldcause the aircraft cabin to reach. The high altitude discriminator 68blocks the voltage signal corresponding to the lower of these altitudesand transmits the signal corresponding to the higher altitude to therate amplifier 90 through conductor 88. The rate amplifier 90 comparesthis to the signal corresponding to actual cabin pressure received fromthe cabin pressure sensor 23 through conductor 24c. If comparison ofthese signals indicates that actual cabin pressure corresponds to analtitude lower than that transmitted by the high altitude discriminator68, the rate limiter amplifier 90 will not be permitted to produce acommand signal calling for descent in cabin altitude.

This feature of the rate amplifier 90 is designed to operate duringdescent of the aircraft to a landing field having an altitudesignificantly greater than sea level, such as the airport at Denver orMexico City. During descent, actual cabin pressure will be lower thanthe pressure indicated by the cabin altitude function generator 72,indicating that the cabin is at a higher altitude than that required. Asaircraft altitude decreases, cabin altitude will decreasecorrespondingly. Because the maximum cabin altitude is only about 8,000ft, it will reach the level of the landing field much before theaircraft reaches that altitude. If descent of the cabin were permittedto continue, it would then be necessary to provide an extended period ofdepressurization of the aircraft after it had landed. Accordingly, afterthe desired cabin altitude as indicated by the output of the cabinaltitude function generator 72 has reached an altitude equivalent tothat selected for the landing field, the high altitude discriminator 68will prevent further descent of the cabin supplying the landing fieldaltitude as the command altitude. When actual cabin pressure has reacheda barometrically corrected value for this altitude, descent of theaircraft cabin terminates.

An additional input to the rate logic 66 is provided by ΔP limit logiccircuit 80. The circuit receives inputs from the pressure sensors 21 and23 corresponding to atmospheric pressure and cabin pressure anddetermines therefrom the pressure differential between inside cabin andoutside ambient pressures in a manner which will be described in detailin connection with FIG. 3. If this pressure differential is greater thana predetermined value so as to potentially endanger the structuralintegrity of the plane, an output is produced by the ΔP limit logiccircuit 80 to the rate logic 66 through conductor 92 which incrementsthe output signal of the rate limiter by an amount proportional to theexcess pressure differential between atmosphere and cabin pressure. Thiscauses the output of the rate logic to be modified so as to change thesaturation level of rate amplifier 90, regardless of the relationship ofthe commanded altitude to the actual altitude.

The input to rate amplifier 90 from high altitude discriminator 68through conductor 88 is always positive. High altitude discriminator 68receives two inputs, one from the selector panel 10 which is the landingfield altitude with barometric correction and one from the cabinaltitude function generator 72 through conductor 86. Both of theseinputs are positive and the discriminator 68 will compare the two todetermine which is the higher altitude or lowest pressure. The lowestpressure is the signal that is passed to rate amplifier 90. Cabinpressure sensor 23 always has a negative output thus a negative voltageis passed to rate amplifier 90 through conductor 24c. The summation ofthe positive high altitude discriminator output and the cabin pressuresensor output determines whether the aircraft is ascending ordescending. If the aircraft is ascending, the output voltage of highaltitude discriminator 68 which will be the commanded cabin pressurewill always be lower than the actual pressure from cabin pressure sensor23. Therefore, for the ascending function, the input to rate amplifier90 will be negative voltage. When the aircraft is descending, thecommanded cabin pressure from high altitude discriminator will begreater than the actual cabin pressure from cabin pressure sensor 23.Thus, the input voltage to rate amplifier 90 will be positive.

Whether the input voltage is positive or negative determines theultimate saturation point for rate amplifier 90. In the preferredembodiment the saturation point for negative inputs corresponds to theinput from rate logic 66, whereas for positive inputs the saturationpoint corresponds to 3/7th of the input from rate logic 66. The outputof rate amplifier 90 is the rate command which is input to dynamiccompensator 100 through conductor 106 where it is combined with thefirst derivative of the output of cabin pressure sensor 23.

The output of rate amplifier 90 has the reverse sign of the input. Thus,when the aircraft is ascending and the input is negative, the outputsignal to open the valves (which is the output of the rate amplifier 90)will be positive. When the plane is descending so that an output signalwhich will tend to close the valves for pressurizing the aircraft cabinis required, the output of rate amplifier 90 will be negative.

The first derivative of the cabin pressure, which is calculated by thedynmic compensator 100, will be negative when the plane is ascendingsince this will be a decrease in cabin pressure and it will be positivewhen the plane is descending since this is an increase in cabinpressure. Also input into the summing node of dynamic compensator 100 isthe output of ground logic 94 through conductor 102. The output ofground logic 94 which becomes the input to dynamic compensator 100 isone of three states, it is either a positive DC, a negative DC or zero.When the aircraft is required to be prepressurized for takeoff, thevoltage input to dynamic compensator 100 is positive DC to override thesummation of the first derivative of cabin pressure and the output ofrate amplifier 90. When the aircraft has landed and it is required thatthe aircraft be depressurized, the output of the ground logic 94 tocompensator 100 is a negative voltage which again will override thesummation of the first derivative of cabin pressure and the output ofrate amplifier 90. While the aircraft is in flight the output of groundlogic 94 is zero so that the summation of derivative of cabin pressureand the output of rate amplifier 90 are the determining factors foropening or closing the actuator valve. If the aircraft is ascending theoutput of rate amplifier 90 will be positive and the first derivative ofthe cabin pressure will be negative. The rate command from rateamplifier 90 is modified by the value of the first derivative to lessenit so that the rate command does not tell the valve to open as fast asif it were unmodified. If the aircraft is descending the output of rateamplifier 90 will be negative and the first derivative of cabin pressurewill be positive and again the summation is merely the modification ofthe rate command from rate amplifier 90.

Dynamic compensator 100 takes the summation of the first derivative ofcabin pressure and the rate command of rate amplifier 90, whethermodified by inputs from ground logic 94 or not, and passes this signalto driver 110 through conductor 108.

Thus a cabin rate change command is transmitted from the rate amplifier90 through conductor 106 to the dynamic compensator 100 which conditionsthe signal to be suitable for transmission to the driver 110. Inaddition, a signal is transmitted to the dynamic compensator 100 fromthe ground logic circuit 94 when the landing gear switch is closedindicating that the aircraft has landed to command that the outflowvalve (not shown) be fully opened.

The rate command passed to the driver 110 causes this circuit to apply avoltage to the motor 116, assuming contact 114c is closed, suitable tooperate the motor in a desired direction and rate of speed. Contact 114cis closed when the automatic cabin pressure controller is in control ofthe cabin pressure or "on". When the switch is open, the controller isdeemed to be "off". Operation of the motor causes the tachometer 120 toproduce a feedback signal permitting proper control of the motor by thedriver.

The electromagnetic clutch 128 is engaged whenever the manual/automaticselector switch 130 is in the automatic position. When this switch isset at manual, actuating winding 134 is de-energized so that the clutch128 disengages and the valve is no longer controlled by the motor 116.This permits the aircraft crew to manually control the outflow valve byconventional means (not shown).

FIG. 3 is a block diagram of ΔP limit logic 80 of FIG. 2. Summing node136 receives a constant voltage input proportional to the maximumallowable differential between ambient atmosphere pressure and cabinpressure through conductor 138. A voltage proportional to the cabinpressure is received from cabin pressure sensor 23 through conductor24b, and a voltage proportional to ambient atmospheric pressure istransmitted from atmosphere pressure sensor 21 to summing node 136through conductor 22c. The output of summing node 136 is applied to amaximum ΔP amplifier 140 through conductor 142. The output of maximum ΔPamplifier 140 goes through a conductor 144 and bifurcates to conductor92 which provides the input into rate logic 66 and to conductor 146which provides input into an inhibit generator 148. Inhibit generator148 then sends a signal to the automatic transfer circuit throughconductor 42c which acts as ΔP inhibit signal.

The inputs to summing node 136 from maximum ΔP reference throughconductor 138 and the atmosphere pressure from the atmosphere pressuresensor 21 through conductor 22c are both negative. The input of thecabin pressure from cabin pressure sensor 23 through conductor 24b ispositive.

ΔP limit logic 80 compares these two signals and if the cabin toatmosphere differential exceeds a preselected value for any reason, ΔPlimit logic will increase the preselected rate limit to compensate forthe increased climb rate of the aircraft.

In operation, the atmospheric pressure and cabin pressure are constantlymonitored by the application to summing node 136 of voltage signalswhich are proportional to pressure. By subtracting the cabin pressurevoltage from the atmospheric pressure voltage, it obtains a voltageproportional to the differential pressure. To this differential pressureis added a voltage proportional to the allowable ΔP so that only whenthe differential pressure exceeds this value will the limit logic supplyan increment. The excess differential pressure is than amplified toproduce an incremental increase in cabin pressure change rate. This isapplied to the rate logic 66 to increment the rate as previouslydescribed.

While ΔP limit logic 80 is overriding the selected rate limit, it alsoprevents automatic transfer to the standby controller by issuing a"true" logic signal to the automatic transfer logic of the othercontroller by conductor 42c, the effect of which will be laterexplained.

It will be noted that in the preferred embodiment maximum ΔP amplifier140 is reverse biased when a negative voltage is applied to the inputthrough conductor 142. Since the ambient atmosphere pressure P_(a) willalways be less than or equal to cabin pressure P_(c), a positive voltagewill appear at conductor 142 and forward bias the amplifier. However, anoutput at conductor 144 from maximum ΔP amplifier 140 is not desireduntil the differential between the cabin pressure and the atmospherepressure exceeds a predetermined level. By the introduction of anegative maximum ΔP voltage through conductor 138 into summing node 136,a positive voltage will not appear at conductor 142 until P_(c) exceedsthe summation of the negative maximum ΔP reference voltage and theatmosphere pressure voltage.

The result can be seen on FIG. 4. The output remains at zero until theinput reaches the valve designated as A, at which point, P_(c) isgreater than maximum ΔP reference plus P_(a) and a positive voltageappears at conductor 142 and forward biases maximum ΔP amplifier 140.Maximum ΔP amplifier 140 is preferably a linear amplifier and producesan output through conductor 144 that increases linearly until it reachesa value designated as C. The output of the amplifier 140 is applied toinhibit generator 148 which informs the automatic transfer circuit thatthe detected difference from scheduled cabin pressure is not due tocontroller malfunction. This inhibits transfer. The signal is alsoapplied to the rate logic 66 of controller 16 which increments the ratesignal by an amount proportional to the output of the maximum ΔPamplifier 140.

If the input, for example, is a voltage equal to that shown as D on thegraph, the output will correspond to the value noted as E. The output ofrate logic 66 will be incremented by the voltage represented by E. C onthe output axis is the value where maximum ΔP amplifier 140 saturatesand the output corresponds to an input of B from summing node 136. Asthe sum of the cabin pressure voltage, the atmospheric pressure voltageand the maximum ΔP reference voltage exceeds value B, amplification willno longer take place.

In the preferred embodiment, C on the graph would correspond to avoltage proportional to a rate increment of 800 ft. per minute.Therefore the rate, although incremented above the selected rate limit,will never exceed the selected rate limit plus 800 feet per minute.

It should be noted that the preferred embodiment ΔP limit logic 80 isused in conjunction with a dual automatic cabin pressure controller.However, the ΔP limit logic 80 can be used with a single automaticcontroller system wherein the maximum ΔP amplifier 140 will onlyincrement the rate of the automatic controller and not pass a signal toinhibit generator or in the alternative will pass a signal to an inhibitgenerator which will prevent an error occurring on annunciator panelwhich may be used in conjunction with the single automatic controllersystem.

Referring now to FIG. 5, cabin altitude function generator 72 consistsprimarily of three amplifiers U1, U2 an U3 and two sets of commonemitter connected transistors, transistor Q1 connected with transistorQ2 and transistor Q3 connected with transistor Q4.

The input for a positive output at amplifier U1 is voltage V₆ which isthe sum of V₂ through resistor R1 and the voltage feedback from theoutput of amplifier U1 through resistor R2. The input for a negativeoutput of amplifier U1 is voltage V₇ which is the voltage produced bythe feedback loop consisting of a common emitter connected transistorsQ1 and Q2.

The output of amplifier U1 is voltage V₄. This voltage is appliedthrough resistor R5 to the bases of transistors Q3 and Q4 and throughresistor R3 to the bases of transistors Q1 and Q2. The emitters oftransistors Q1 and Q2 are connected and through resistor R4 to feedamplifier U1 and capacitor C1. Capacitor C1 is connected to ground. Thecollector connection of transistor Q1 is at voltage V₃ and the collectorconnection of transistor Q2 is ground. Voltage V₃ is composed of theoutput voltage of amplifier U3 and the voltage which comes from resistornetwork R9, R10, R11, and R13. This resistive network receives onlypositive voltages from conductor 22c since negative voltages are blockedby diode D1. Resistive network R9, R10, R11 and R13 receives a negativeinput voltage at conductor 42a₂ which is the inverse of positive voltageV₂ at conductor 42a₁. The voltage which determines a negative output atamplifier U3 is composed of voltage minus V₁ through conductor 22a₂which passes through resistor R12 and the output voltage of resistivenetwork R9, R10, R11 and R13. The voltage which determines a positiveoutput from amplifier U3 is determined by a ground connection.

Voltage V₄ also feeds common emitter connected transistors Q3 and Q4through resistor R5 which bifurcates and feeds the bases of Q3 and Q4.The collector of Q4 is connected to ground and the collector of Q3 isconnected to conductor 22a₁ which supplies voltage V₁ which is a voltageproportional to the atmospheric pressure from the atmosphere pressuresensor 21. The emitters of transistors Q3 and Q4 are connected togetherand supply voltage V₈ which passes through resistor R6 and overcapacitor C2 to supply the input that determines the positive voltageoutput from amplifier U2. The voltage that determines a negative outputfrom the amplifier U2 is determined by the feedback loop from the outputof U2 through resistor R7 to the negative determining terminal of U2 andfrom resistor R8 which is connected to ground. The output of amplifierU2 is V₀.

V₀ is the output at conductor 74 to rate logic 66 and to high altitudediscriminator 68 through conductor 86. V₁ is the input that comes inthrough conductor 22a₁ from atmosphere pressure sensor 21. V₁ is avoltage proportional to the ambient atmospheric pressure. V₂ is aconstant positive DC voltage used as a biasing voltage which comes fromthe power supply 70. V₁ is input at conductor 22a₁ and -V₁ is input atconductor 22a₂. V₂ is input at conductor 42a₁ and -V₂ is input atconductor 42a₂.

Voltage V₂ is applied through resistor R1 which causes a voltage drop sothat a somewhat diminished voltage V₆ is applied to the positiveterminal of amplifier U1. When V₆ is more positive than V₇ which is atthe negative terminal of amplifier U1, the output voltage V₄ ofamplifier U1 wll be a positive voltage which will travel throughresistor R3 to the bases of the common emitter connected transistors Q1and Q2.

When V₄ is positive, NPN transistor Q1 will be on and PNP transistor Q2will be off. When transistor Q1 is on, voltage V₃ will pass through thetransistor and appear as voltage V₅ at the emitter connection toresistor R4. R4 is part of the RC charging network with capacitor C1 andvoltage V₇ at the negative input terminal of amplifier U1 will increaseexpotentially to the maximum value of V₅ which is equal to V₃.

When V₇ charges to a value slightly greater in value than voltage V₆,the output of amplifier U1 will go negative, and V₄ will becomenegative. When V₇ is negative it will feed back through resistor R2 tovoltage V₆ and cause voltage V₆ also to swing negative. V₄ will passthrough resistor R3 to the bases of the Q1, Q2 common emitter connectionand will turn transistor Q1 off and will turn transistor Q2 on. Whentransistor Q2 is on, voltage V₇ will discharge toward zero throughcapacitor C1 and resistor R4 since transistor Q2 has its collectorconnected to ground. When V₇ discharges to a value slightly less thanV₆, the output of amplifier U1 will again swing positive and V₄ willalso become positive. When V₄ goes positive it will make V₆ slightlymore positive through resistor R2 and V₄ will pass through resistor R3again to the common emitter connection Q1, Q2 and turn transistor Q1 onand transistor Q2 off and repeat the cycle as previously described.

Thus voltage V₄ will appear as a square wave. Voltage V₄ also passesthrough resistor R5 and feeds the base connections of the common emitterconnection between NPN transistor Q3 and PNP transistor Q4. When V₄ isnegative, transistor Q4 will be conducting and the output of transistorQ4 will be zero since its collector is grounded. When voltage V₄ ispositive, transistor Q3 will be conducting and will pass voltage V₁through transistor Q3 to resistor R6. Thus, voltage V₈ at resistor R6will have the same relationship to voltage V₁ as voltage V₅ has tovoltage V₃. Resistor R6 and capacitor C2 filter voltage V₈ which is thepositive input to amplifier U2. Amplifier U2 scales voltage V₈ so thatthe proper voltage V₀ is output at conductors 74 which is applied to therate logic 66 and conductor 86 which is applied to high altitudediscriminator 68.

Voltage V₅ is the output of amplifier U3 and will remain as a positiveoutput as long as the input to amplifier U3 at its negative determiningterminal is less than zero. The input to amplifier U3 is -V₁ which isthe negative of the atmosphere pressure sensor 21 output. To voltage -V₁is added a negative voltage, -V₂, through resistor R11. This is modifiedby the positive feed back through resistor R13. The input to amplifierU3 is also modified by the input from conductor 22c which must passthrough a diode before adding to voltage -V₂ and -V₁. A negative voltagewill reverse bias the diode and nothing will pass. A positive voltagewill forward bias the diode and will add directly to the negativevoltages V₂ and V₁ through the resistive network R9 and R10. The voltageat conductor 22c is negative when the plane is ascending and positivewhen the plane is descending so that the resistive network of R9 and R10only affect the input to amplifier U3 when the plane is descending.

FIG. 6 is a series of graphs labeled 6A-6C which show the variousvoltage relationships associated with cabin altitude function generator72. Graph 6A shows the relationship of voltages V₃, V₆, V₂ and V₇. Ascan be seen, voltage V₆ has symmetrical swings around voltage V₂ whichis caused by feedback resistor R2. Voltage V₇ will expotentially chargetowards voltage V₃ to a value slightly greater than V₆ whenevertransistor Q1 is on. When Q1 is turned off and Q2 is turn on, voltage V₇will exponentially discharge towards zero to a value slightly less thanvoltage V₆ which has shifted to the negative side of V₂ due to thenegative feed back through resistor R2. When V₇ becomes less positivethan V₆, the output of amplifier U1 goes positive, turns Q2 off and Q1on thus repeating the cycle. Graph 6B shows voltage V₄ and itsrespective values when Q1 is on and Q2 is off and also when Q1 is offand Q2 is on. Graph 6C shows the relationship of V₃ and V₅. V₅ is equalto V₃ when Q1 is on and Q2 is off. When Q2 is on V₅ equals the collectorvoltage of Q2 which is at ground.

It will be noted that due to feedback resistor R2, voltage V₆ will besymmetrical with respect to V₂ since voltage V₄ is symmetrical withrespect to zero and the average value of V₆ will be equal to V₂. Itshould also be noted that if the circuit is scaled so that V₇ is nearlylinear, then the average value of V₇ is equal to V₂, because it issymmetrical around V₂. The average value of V₇ is equal to the averagevalue of V₅ or

    V.sub.7 (ave)=V.sub.5 (ave)

Thus the following relationships are established:

    V.sub.2 =V.sub.6 (ave)=V.sub.7 (ave)

The average value of V₅ is equal to V₃ multiplied by the time periodthat Q1 is on (t₁) divided by the time period Q1 is on plus the timeperiod when Q2 is on (t₂) or ##EQU1##

The time period that Q1 is on divided ty the time period Q1 is on plusthe period Q2 is on is the duty cycle of V₄ or the duty cycle of##EQU2##

Since transistor Q3 and Q4 are driven by V₄ in the same manner as Q1 andQ2, V₈ bears the same relationship to V₁ as V₅ bears to V₃ ##EQU3##since the duty cycle is determined by V₄, ##EQU4## for similartransistors.

Therefore, ##EQU5## which gives an output voltage proportionate to thesensed atmospheric pressure.

FIG. 7A is a graph of the function generated by the preferred embodimentof cabin altitude function generator 72. Curve AB is the function usedduring climb and cruise while no input from atmosphere pressure sensor21 is passing into the circuit through conductor 22c due to the reversebiasing of diode D1. The orientation of diode D2 prevents resistors R9and R10 from affecting the characteristics of amplifier U3. Curve AC isthe function used during descent when diode D1 is forward biased and apositive voltage is added into the input terminal of amplifier U3through resistive network R9 and R10, R11 and R13. In the preferredembodiment curve AB is generated on the basis of keeping the cabinpressure rates at a minimum when the aircraft is ascending at itsmaximum rate without exceeding the maximum ΔP for which the aircraft isdesigned. For curve AB, P_(c) as generated by the function is alwaysgreater than P_(a) as long as P₁ is less than or equal to X. For P_(a)greater than X, P_(c) becomes less than P_(a). Under these conditions itcan be seen that when attempting to land at an altitude which has acorresponding pressure greater than X, the cabin pressure would try tobe less than the ambient pressure. This would be the equivalent ofcommanding the outflow valve to open so that the inside cabin pressurecould go below the outside ambient pressure which is an impossiblecondition. This would result in the outflow valve being fully openedwith no cabin pressure rate control. In order to avoid this, resistorsR9 and R10 are introduced on descent influencing the denominator of thecabin pressure function generated in the preferred embodiment by makingthe negative voltage input to amplifier U3 less negative thus loweringthe value of voltage V₃. The function of the preferred embodiment cabinaltitude function generator is P_(c) =(P_(a) /(K₂ P_(a) +K₃) Since thevalue of K₂ P_(a) +K₃ is proportional to V₃, lowering of V₃ will lowerthe denominator and thus give a curve as depicted by curve AC. Thesituation where P_(a) is greater than point X or the altitude of theaircraft is lower than the altitude corresponding to point X, does notpresent a problem or takeoffs due to the fact that the aircraft ambientpressure P_(a) will be decreasing faster then the cabin pressure andoperation on the curve AB will never occur and P_(a) will always be lessthan P_(c).

FIG. 7B shows the relationship between the cabin pressure (P_(c)) andthe ambient aircraft pressure (P_(a)) of previous automatic cabinpressure controllers. The ideal relationship as shown in FIG. 7A bycurve A--B was attempted through straight line approximations DE, EF andFG. Although previous attempts consist of many straight line segments toapproximate the ideal curve, three straight line segments are depictedfor demonstration. As can be seen, two deficiencies occur in this methodof constructing a cabin pressure versus ambient pressure curve. Thefirst is that the straight line approximations do not quite achieve thecurve as desired; the second is that through the use of straight lineapproximations, points of inflection occur at every joining of thestraight line segments. The points of inflection do not appear to be farreaching in effect on the curve P_(c) versus P_(a). However, when therate of change of cabin pressure (the first derivative of P_(c)) iscalculated, points of inflection appear as spikes on what should appearas a straight line for a constant rate of change of cabin pressure.

Referring now to FIG. 8, the automatic transfer circuit 34 andassociated components are illustrated in detail, it being understoodthat automatic transfer circuit 32 has an identical set of componentssimilarly connected.

Malfunction detection logic 150 is connected to power supply 70 of theautomatic controller 16 through conductors 42a and 42b and is connectedto cabin pressure selector 10 through conductors 43a and 43b.Malfunction detection logic 150 is also connected to a valve switch 124through conductor 41, ΔP limit logic 80 through conductor 42c, throttleswitch 56 through conductor 64a, landing gear switch 46 throughconductor 54a, automatic/manual transfer reset 154 through conductor156, automatic transfer inhibit 158 through both conductors 160 and 162,to primary/standby status memory 164 through conductor 166, to standbyoff logic 168 through conductor 170, to OR gate 172 through conductor174, and to automatic transfer circuit 32 through conductor 36a.

The connections in automatic transfer circuit 32 from conductorsoriginating in automatic transfer circuit 34 are shown as dotted linesadjacent to the conductor originating in automatic transfer circuit 34and included within a single circle. With this in mind it can be seenthat malfunction detection logic 150 of automatic transfer circuit 34 isconnected to automatic transfer inhibit 158 and OR gate 176, both ofautomatic transfer circuit 32 through conductor 36a.

OR gate 176 of automatic transfer circuit 34 is connected withsuccessive flight transfer 206 through conductor 177, to standby offlogic 168 through conductor 178, and to interconnect logic 180 throughconductor 182 on its input side.

OR gate 176 is connected to on-off control 184 through conductor 186 onits output side. On-off control 184 is connected to automatic cabinpressure controller 17 through conductors 44a and 44b, to interconnectlogic 180 through conductors 188 and 190, to standby off logic 168through inverter 192 via conductor 194, to primary/standby status memory164 through conductor 196, to primary on latch 198 through conductor200, to successive flight transfer 206 through conductor 208, to ANDgate 210 through conductor 212, and to interconnect logic 180 ofautomatic transfer circuit 32 through conductor 36d. The output side ofOR gate 172 is connected to on-off control 184 through conductor 214. Inaddition to being connected to malfunction detection logic 150 throughconductor 174, the input side of OR gate 172 is also connected tosuccessive flight transfer 206 through conductor 216, primary on latch198 through conductor 218, and interconnect logic 180 through conductor220.

Interconnect logic 180 is connected to on-off control 184 of automatictransfer circuit 32 through conductor 40d. Primary on latch 198 isconnected to standby off logic 168 of automatic transfer circuit 32through conductor 40b, so standby off logic 168 of automatic transfercircuit 34 is connected to primary on-latch 198 of automatic transfercircuit 32. Standby off logic 168 also is connected to primary/standbystatus memory 164 through conductor 222 and to selector panel 10 throughinverter 223 via conductor 43c. Primary/standby status memory 164 hasdual connections to successive flight transfer 206 through conductors224 and 226. Primary/standby status memory 164 is connected to AND gate210 through conductor 228, to primary lamp 230 through conductor 232, toexclusive OR gate 234 of automatic transfer circuit 34 through conductor236, and to exclusive OR gate 234 of automatic transfer circuit 32through conductor 36c.

Since the circuits of automatic transfer 32 and 34 are identical,exclusive OR gate 234 of automatic transfer circuit 34 receives an inputfrom primary/standby status memory 164 of automatic transfer circuit 32through conductor 40c. On its output side, exclusive OR gate 234 isconnected to auto/manual transfer reset 154 through conductor 238.Auto/manual transfer reset 154 is connected to cabin pressure selector10 through conductor 240 and to auto transfer inhibit 158 throughconductor 242. Auto transfer inhibit 158 is connected to successiveflight transfer 206 through conductor 244 and to cabin pressure selector10 through conductor 246. Successive flight transfer 206 is connected tothrottle switch 56 through conductor 64b and to landing gear switch 46through conductor 54b.

During each flight one controller is operated in the primary mode andone controller is operated in the standby mode. When the aircraft lands,successive flight transfer 206 will switch modes of the controllers forthe next flight. The specific details of connections and operation ofsuccessive flight transfer 206 will be discussed in connection with FIG.11. However, its output is of immediate interest. If automatic cabinpressure controller 17 is "on", successive flight transfer 206 ofautomatic transfer circuit 34 will issue a true signal toprimary/standby status memory 164 through conductor 226 and to OR gate176 through conductor 177 upon closing of the landing gear switch 46 ataircraft touchdown. Any true input at OR gate 176 is passed throughconductor 186 to on-off control 184. On-off control 184 then energizescoil 114b of control switch 114 which opens contact 114c between driver110 and motor 116 (see FIG. 2). If automatic cabin pressure controller17 is off, successive flight transfer 206 will issue a true signal toprimary/standby status memory 164 through conductor 224 and to OR gate172 through conductor 216 upon closure of the landing gear switch 46.Any true input at OR gate 172 is passed through conductor 214 to on-offcontrol 184. On-off control 184 then energizes coil 114a of controlswitch 114 which closes contact 114c between driver 110 and motor 116(see FIG. 2).

Successive flight transfer 206 receives an input through conductor 208from on-off control 184 to indicate whether or not the controller is on.Successive flight transfer 206 also programs the primary/standby statusmemory 164 and instructs it as to which mode automatic cabin pressurecontroller 17 will operate for the next flight. If a true signal isissued to primary/standby status memory 164, through conductor 226, itwill indicate that automatic cabin pressure controller 17 is going to beoperating in the standby mode. If a true signal is issued throughconductor 224 that will indicate that automatic cabin pressurecontroller 17 will be operating in the primary mode for the upcomingflight.

When automatic cabin pressure controller 17 is operating in the standbymode, automatic transfer circuit 34 is monitoring the performance ofcabin pressure of automatic cabin pressure controller 16. If cabinpressure controller 16 malfunctions, automatic transfer circuit 34 willswitch control to automatic cabin pressure controller 17. When automaticcabin pressure controller 17 is operating in the primary mode, automatictransfer circuit 34 is disabled and automatic transfer circuit 32monitors the performance of cabin pressure controller 17. Automatictransfer circuit 32 will switch control to automatic cabin pressurecontroller 16 if automatic cabin pressure controller 17 malfunctions.

Malfunction detection logic 150 receives inputs from controller 16,cabin pressure selector panel 10, throttle switch 56, landing gearswitch 46 and the valve switch 124; the specific details of which willbe discussed in connection with FIG. 9. On the basis of the inputs whichmalfunction detection logic 150 receives, it is able to determine suchinformation as whether the aircraft is in flight, whether it isascending or descending, whether the cabin pressure change rate exceedsthe selected rate, whether the ΔP limit logic 80 is controlling thecabin pressure rate of change, whether a flow problem exists in theaircraft, and whether the primary automatic cabin pressure controller isadequately powered.

The normal output of malfunction detection logic 150 at conductor 174 isa false or zero output. Malfunction detection logic 150 of the preferredembodiment is set or its output at conductor 174 goes true if, while theaircraft is in flight, either the primary automatic cabin pressurecontroller loses power, or the cabin pressure is ascending at a rate inexcess of the selected rate and neither the ΔP limit logic 80 iscontrolling nor does a flow problem exist, or the aircraft cabinaltitude is descending at a rate greater than the selected rate. A trueoutput from the malfunction detection logic 150 at conductor 174simultaneously turns automatic cabin pressure controller 17 on andautomatic cabin pressure controller 16 off.

Automatic cabin pressure controller 17 is turned on by the true signalpassing to OR gate 172 through conductor 174 which in turn activateson-off control 184 as previously described. Automatic cabin pressurecontroller 16 is turned off by passing the true signal to automatictransfer circuit 32 through conductor 36a. The connections in automatictransfer circuit 32 can be seen by dotted line 40a which shows theidentical connections between the malfunction detection logic ofautomatic transfer circuit 32 and automatic transfer circuit 34. Thetrue signal is received by OR gate 176 of automatic transfer circuit 32through conductor 40a. It is then passed to its on-off control 184through conductor 186 which turns its controller off as previouslydescribed.

Not only does malfunction detection logic 150 turn one controller offand one controller on, it also sets automatic transfer inhibit 158 ofautomatic transfer circuit 34 and an identical automatic transferinhibit in automatic transfer 32. Again, the connection in automatictransfer circuit 32 can be seen in dotted conductor 40a which comes fromautomatic transfer circuit 32. By setting automatic transfer inhibit,automatic transfer back to the malfunctioning controller is blocked, themalfunction detection logic 150 is disabled and the successive flighttransfer circuit 206 is inhibited so that the status of the controllerswill remain the same as when the malfunction occurred.

When automatic transfer inhibit 158 is set, it will relay a signal tothe cabin pressure selector panel through conductor 246 which willilluminate a light 3 (see FIG. 12) indicating to the flight crew thatautomatic transfer function is locked out. Additionally, the fact thatthe standby is in control of the cabin pressure rate of change isannunciated to the crew through AND gate 210, which receives a truesignal from the primary/standby memory 164 through conductor 228 whenthe controller is in the standby mode. In addition to the signal that itreceives through conductor 228, AND gate 210 also receives a signalthrough conductor 212 which comes from on-off control 184 which is truewhen the controller 17 is on. Whenever the controller 17 is standby andon, the output of the AND gate 210 will go to cabin pressure selectorpanel 10 and illuminate a light 2 (FIG. 12) which indicates that thestandby is in control of the cabin pressure.

Provision is made on cabin pressure selector panel 10 for the manualselection of either the primary or the standby controller. When toggleswitch (see FIG. 12) is moved to the standby position, it will issue atrue signal through conductor 43b which will set malfunction detectionlogic 150 and malfunction detection logic will issue a true signalthrough conductor 174. This true will also issue through conductor 43cto inverter 223 which is connected to standby off logic 168. Theinverter will change the true signal to a false and will have no effecton standby off logic.

When the toggle switch is moved to the primary position a false signalis issued through conductors 43b and 43c. This false signal will arriveat malfunction detection logic 150 and will not change its output.However, a false signal through conductor 43c will go to inverter 223,causing a true signal to be issued to standby off logic 168, setting itso that its output will be a true. When standby off logic 168 is set andis missing a true signal as its output, the true signal will resetmalfunction detection logic 150 and its output at conductor 174 will bea false. The true signal will then pass to OR gate 176 through conductor178 which turns the automatic cabin pressure controller 17 off aspreviously described.

This true signal is also applied to automatic transfer circuit 32through conductor 36b. This connection can be seen by dotted conductor40b which shows the connection between standby off logic of automatictransfer circuit 32 to primary on latch 198 of automatic transfercircuit 34.

When automatic cabin pressure controller 16 is turned off by on-offcontrol 184, the absence of a true signal is communicated throughconductor 194 to inverter 192. Inverter 192 then issues a true output tostandby off logic 168 which resets standby off logic. Resetting standbyoff logic 168 changes its output to zero or a false signal thuscompleting the loop and returning standby off logic to its normal state.Primary on latch 198 is set by a true signal from standby off logic ofautomatic transfer circuit 32 and will issue a true signal to OR gate172 which will turn automatic cabin pressure controller 17 on as hasbeen previously described. When automatic cabin pressure controllersystem 17 is turned on by on-off control 184, a true signal is issuedwhich will return to primary on latch 198 through conductor 200 andreset the primary on latch again to its normal state which is no output.

If automatic transfer has taken place and the flight crew wishes toreturn control of the cabin pressure rate to a primary controller, thiscan also be done by pushing the reset switch in cabin pressure selectorpanel 10. Depressing the reset button will issue a signal toautomatic/manual transfer reset 154 which will then pass to malfunctiondetection logic 150 through conductor 156 and automatic transfer inhibit158 through conductor 242. Resetting the malfunction detection logic 150will cause the output at conductor 174 to go to zero or false. Resettingthe automatic transfer inhibit 158 will remove the previouslyestablished inhibit and will extinguish the illumination of transferlock out in the cabin pressure selector panel 10. Resetting automatictransfer inhibit 158 will also remove the inhibit from successive flighttransfer 206 through conductor 244 and from malfunction detection logic150 through conductor 160. Thus while use of toggle switch 1 (FIG. 12)alone will restore control to the primary controller, a transfer lockoutswitch which may be incorporated into the transfer lockout light 3, maybe activated to also reset the automatic monitoring and transferfeatures associated with the standby controller.

When primary/standby status memory 164 is instructed by successiveflight transfer 206 as to whether automatic cabin pressure controllerwill be primary or standby, it will issue a signal to exclusive OR gate234 through conductor 236. A true input into exclusive OR gate 234indicates that automatic cabin pressure controller is in a standby mode.A false input indicates primary mode. This true signal is also passed toautomatic transfer circuit 32 through conductor 36c. The connectionswithin automatic transfer circuit 32 can be seen by the identicalconnections within automatic transfer circuit 34 as shown by dottedconductor 40c which is input into exclusive OR gate 234. Exclusive ORgate 234 receives the output coming from primary/standby status memoryof automatic transfer circuit 32 through conductor 40c.

If both inputs to exclusive OR gate 234 are either true or falseindicating that both controllers are either in the primary or standbymode, exclusive OR gate 234 will issue a true signal to theautomatic/manual transfer reset 154 through conductor 238.Automatic/manual transfer reset 154 will then reset the malfunctiondetection logic 150 and automatic transfer inhibit 158. By resettingmalfunction detection logic 150 it will indicate that, whatever itsoutput is, it should be reset to zero. By this, the controllers areprevented from simultaneously operating in either the primary or in thestandby mode.

Primary/standby status memory 164 will also issue a true signal toprimary lamp 230 through conductor 232 if automatic cabin pressurecontroller 17 is primary for this flight. This lamp indicates to theflight crew which cabin pressure controller is operating in the standbymode so that if a malfunction is noted by the flight crew, themaintenance crew will know which automatic cabin pressure controllermalfunctioned. Operation of automatic transfer inhibit 158 uponmalfunction prevents the change of primary controller by successiveflight transfer 206 upon landing and maintains illumination of primarylamp 230 for repair identification.

In order to prevent a situation where both automatic cabin pressurecontrollers are either on or off, an interconnect logic 180 is provided,the detailed operation of which will be discussed in connection withFIG. 11. Interconnect logic 180 receives inputs from on/off control 184of automatic transfer circuit 34 and on-off control of automatictransfer circuit 32. If automatic cabin pressure controller 17 is on,interconnect logic 180 will receive a true input through conductor 190,if it is off it will receive a true input through conductor 188. Whetherautomatic cabin pressure controller 17 is on is also issued as a truesignal to the interconnect logic of automatic transfer circuit 32. Theconnections in automatic transfer circuit 32 can best be seen throughdotted conductor 40d which connects interconnect logic 180 with on-offcontrol of automatic transfer circuit 32.

Interconnect logic 180 will evaluate these inputs and determine whetherboth controllers are on or both controllers are off. If both controllersare on, interconnect logic 180 will issue a true signal to OR gate 176through conductor 182 which, in turn, will turn the automatic cabinpressure controller off as has been previously described. If bothcontrollers are off, interconnect logic 180 will issue a true signal toOR gate 172 through conductor 220 which, in turn, will turn automaticcabin pressure controller 17 on as has been previously described.

Referring now to FIG. 9, the basic malfunction monitoring and switchovercircuitry of the malfunction detection logic 150 of automatic transfercircuit 34 is shown in detail, it being understood that malfunctiondetection logic of automatic transfer circuit 32 has an identical set ofcomponents similarly connected. Additional inputs described inconnection with FIG. 8 for switching between primary and standbycontrollers are not duplicated herein.

Power loss detector 248 is connected to the power supply of automaticcabin pressure controller 16 through conductor 42a and the input side ofOR gate 250 through conductor 252. The input side of OR gate 250 is alsoconnected to rate monitor circuit 254 through conductor 256 and to ANDgate 258 through conductor 260. Rate monitor circuit 254 is connected toautomatic cabin pressure controller 16 through conductor 42b and tocabin pressure selector panel 10 through conductor 43a.

AND gate 258 is connected to valve switch 124 through conductors 262 and41 (FIG. 8) and to the inhibit generator of ΔP limit logic of automaticcabin pressure controller 16 (FIG. 1) through inverter 264 throughconductor 42c and to rate monitor circuit 254 through conductor 265. Theoutput side of OR gate 250 is connected to the input side of AND gate266 through conductor 268. The input side of the AND gate 266 is alsoconnected to the output side of OR gate 270 through conductor 272. Theinput side of OR gate 270 is connected to throttle switch 56 throughconductor 64a and to inverter 274 through conductor 276. Inverter 274 isconnected to landing gear switch 46 through conductor 54a.

The output side of AND gate 266 is connected to malfunction switch overcontrol 278 through conductor 280. Malfunction switch over control 278is connected to OR gate 172 (FIG. 8) through conductor 174.

The input side of AND gate 282 is connected to rate monitor circuit 254through conductor 284 and to inverter 286 through conductor 288.Inverter 286 is connected to valve switch 124 through conductors 290 and262. The output side of AND gate 282 is connected to flow light 7 (FIG.12) through conductor 294.

Malfunction switch over control 278 will issue a true signal to OR gate172 (see FIG. 8) through conductor 174 which will turn off automaticcabin pressure controller 16 and turn on automatic cabin pressurecontroller 17 when it receives a true signal from AND gate 266 throughconductor 280. AND gate 266 will issue a true output only when the inputfrom OR gate 250 through conductor 268 and the input from OR gate 270through conductor 272 are both true.

The output from OR gate 270 indicates whether or not the aircraft is inflight. If the aircraft is in flight the output will be true, if theaircraft is on the ground the output will be false. Flight is indicatedwhen either one of two inputs to OR gate 270 is true. The first inputfrom throttle switch 56 will be true when the throttle is in theadvanced position. The second input through conductor 276 from inverter274 will be true when the signal from landing gear switch 46 throughconductor 54a to inverter 274 is false. The landing gear switch 46issues a false signal when the landing gear switch is open. When theaircraft is on the ground, landing gear switch will be closed and willbe issuing a true signal. This true signal will arrive at inverter 274and a false signal will be issued to OR gate 270 through conductor 276.When the aircraft is in the air the landing gear switch will be closedand a false signal will be issued to inverter 274. When a false signalis received by inverter 274 a true signal is passed to OR gate 270through conductor 276 thus, when the aircraft is in the air a truesignal will be issued by OR gate 270 to AND gate 266 through conductor272. Input from the throttle switch provides a flight signal when theaircraft is in the process of taking off. Whether the aircraft is inflight acts as an inhibit since a true input will be present when theaircraft is in flight and a true input is necessary before AND gate 266will issue a true output to malfunction switch over control 278.

OR gate 250 will issue a true output to AND gate 266 through conductor268 when either of its three inputs is true. One input to OR gate 250 isfrom power loss detector 248. Power loss detector 248 receives a powersignal from automatic cabin pressure controller 16. As long as powerfrom the power supply is within a specified range in automatic cabinpressure controller 16 the output of power loss detector 248 is false.When power deviates from the specified range in automatic cabin pressurecontroller 16, power loss detector 248 issues a true signal to OR gate250 through conductor 252. This true signal will be passed to AND gate266 through conductor 268 which, in turn, will issue a true signal tomalfunction switch over control 278 if a true signal has been receivedfrom OR gate 270 indicating that the aircraft is in flight.

A second input to OR gate 250 comes from rate monitor circuit 254. Ratemonitor circuit 254 receives an input of the sensed cabin pressure climbrate from automatic cabin pressure controller 16 through conductor 42band the selected rate limit from cabin pressure selector panel 10through conductor 43a. Rate monitor 254 compares these two inputs anddetermines whether the cabin pressure change rate exceeds the selectedrate limit. If the aircraft is descending and the sensed rate exceedsthe selected rate limit it will issue a true signal to OR gate 250through conductor 256. This true signal will be passed by OR gate 250 toAND gate 266 through conductor 268 as has been previously described.

The third input to OR gate 250 of the preferred embodiment comes fromAND gate 258. AND gate 258 receives three inputs, all of which must betrue before it will issue a true signal to OR gate 250. The first inputis from rate monitor circuit 254. When rate monitor circuit 254determines that the sensed cabin pressure change rate exceeds theselected rate limit and the aircraft is ascending, it will issue a truesignal to AND gate 258 through conductor 265.

The second input to AND gate 258 is from valve switch 124. When thevalve switch is closed it will issue a false signal. A true signal willbe issued by the valve switch 124 when it is open.

The third input to AND gate 258 is from ΔP limit logic of automaticcabin pressure controller 16. Under normal conditions the inhibitgenerator of ΔP limit logic will be issuing a false signal which will beinput to inverter 264 through conductor 42c. The output of inverter 264under normal conditions will be a true signal and will not block theoutput of the AND gate 258. When the ΔP limit logic is incrementing thecabin pressure rate of change it will also issue a true signal toinverter 264 through conductor 42c. The true signal arriving at inverter264 will be passed to AND gate 258 as a false signal thus inhibiting theoutput of AND gate 258. The output of AND gate 258, when true, indicatesthat the cabin is ascending at a rate greater than the preselected ratelimit and the output flow valves are not completely closed and that theΔP limit logic is not controlling the cabin pressure rate of change.

Malfunction switchover control 278 will issue a true signal indicatingthat automatic cabin pressure controller 17 should be turned on onlywhen the plane is in flight and either the automatic cabin pressurecontroller 16 has lost power, or the cabin is descending at a rategreater than the selected rate, or the cabin is ascending at a rategreater than the selected rate limit while the ΔP limit logic is not incontrol and the outflow valve is not completely closed.

Malfunction detection logic 150 performs an annunciation function inaddition to detecting a malfunction in the primary controller. Theoutput of rate monitor circuit 254 bifurcates and one output goes to ANDgate 258 and the other to AND gate 282 through conductor 284. AND gate282 also receives an output from inverter 286 through conductor 288. Theinput to inverter 286 comes from valve switch 124. As was said earlier,valve switch 124 issues a true signal when the outflow valve is open anda false signal when the valve is closed. When the overflow valve isclosed, the false signal is input to inverter 286 which will pass a truesignals to AND gate 282 through conductor 288. AND gate 282 will issuean output through conductor 294 to cabin pressure selector panel 10illuminating flow light 7 when it receives a signal from rate monitorcircuit 254 that the altitude of the cabin is ascending at a rategreater than the selected rate limit and the outflow valve closed. Thus,illumination of flow light 7 indicates to the flight crew that the cabinpressure is decreasing while the outflow valves are fully closed. Thismeans that there is a leak on the aircraft of a magnitude greater thanthe cabin inflow and that the failure to properly pressurize is not dueto a faulty automatic cabin pressure controller. The crew is then awarethat it must either plug the leak or increase inflow to permit propercontrol of cabin pressure.

Referring now to FIG. 10, the detailed connections of successive flighttransfer circuit 206 are illustrated. The throttle switch 56 isconnected via conductor 64b₂ to an AND gate 296, to AND gate 298 throughinverter 300 via conductor 64b₁, and to a latch 302 through conductor304. The landing gear switch 46 is connected via conductor 54b₂ to ANDgate 296, to AND gate 298 through conductor 54b₁, to AND gate 306through conductor 308, and to inverter 310 through conductor 312.Inverter 310 is connected to a latch 314 through conductor 316.

The input side of AND gate 306 is also connected to latch 314 throughconductor 318 and the inverter 320 of AND gate 306 is connected toautomatic transfer inhibit 158 through conductor 244. The output side ofAND gate 306 is connected to landing gear switch control 322 throughconductor 324. Landing gear switch control 322 is connected toprimary/standby status memory 164 through conductors 224 and 226, to ORgate 172 through conductor 216, and to OR gate 176 through conductor 177(see FIG. 8). Landing gear switch control 322 is also connected toon-off control 184 through conductor 208. Latch 314 is connected to ORgate 326 through conductor 328. OR gate 326 is connected latch 302through conductor 330 and to sixty second delay 332 through conductor334. Latch 302 is connected to twenty second delay 336 through conductor338. Twenty second delay 336 is connected to the output side of the ANDgate 298 through conductor 340. Sixty second delay 332 is connected tothe output side of AND gate 296 through conductor 342.

AND gate 298 and AND gate 296 both receive two inputs. One input is fromthe landing gear switch 46 and the other input is from the throttleswitch 56. Landing gear switch 46 will issue a true signal when it isclosed, indicating that the aircraft is on the ground. Throttle switch56 will issue a true signal when it is advanced, indicating that theaircraft is taking off or is in flight. The input to AND gate 298 fromthrottle switch 56 must pass through inverter 300 before it becomes aninput to AND gate 298 thus when the aircraft is on the ground, the inputto AND gate 298 is true and when the aircraft is in flight, the input toAND gate 298 is true. When the aircraft is in flight, the input to ANDgate 296 is true. Since neither the input to AND gate 298 throughconductor 54b₁ nor the input to AND gate 296 through conductor 54b₂ fromlanding gear switch 46 passes through an inverter, both AND gates 296and 298 receive true inputs only when the aircraft is on the ground. Iflanding gear switch 46 closes, it issues a true signal to AND gate 298through conductor 54b₁ and to AND gate 296 through conductor 54b₂. Ifthe throttle switch 56 is not in the advanced position, indicating thatthe aircraft has landed, it issues a false signal to AND gate 296through conductor 64b₂ and to inverter 300 through conductor 64b₁. ANDgate 296 will have a false output while AND gate 298 will have a trueoutput since the false input to inverter 300 results in a true input toAND gate 298. This condition indicates that the aircraft has landed andthe controller should switch modes. When AND gate 298 has a true output,it is passed to twenty second delay 336 through conductor 340. Thetwenty second delay is to eliminate transfers due to bounce on landing.After the twenty second delay a true signal is passed to latch 302through 338. Latch 302 is set and will issue a true output to OR gate326 through conductor 330. OR gate 326 will then issue a true signal toset latch 314 through conductor 328. Latch 314 then issues a true signalto AND gate 306 through conductor 318 which passes to landing gearswitch control 322 through conductor 324. Landing gear switch transfer322 then switches modes between the controllers as described inconnection with FIG. 8.

During take off, throttle switch 56 is advanced issuing a true signal toAND gate 296 and, through inverter 300, a false signal to AND gate 298.Thus the output of AND gate 298 becomes a false and the output of ANDgate 296 becomes a true. The output of AND gate 296 passes to sixtysecond delay 332 through conductor 342. The true signal from throttleswitch 56, when advanced, will reset latch 302 through conductor 304 andthe output of latch 302 will become a false to OR gate 326 throughconductor 330. Latch 302 is reset so that the transfer can again takeplace the next time the aircraft lands. If landing gear switch 46 doesnot open within 60 seconds after advanced throttle, sixty second delay332 will issue a true to OR gate 326 through conductor 334 which will bepassed to set latch 314 through conductor 328.

Assuming the normal take off, landing gear switch 46 will open thusissuing a false input to AND gate 296 through conductor 54b₂ and the ANDgate 298 through conductor 54b₁. However, the false signal issued bylanding gear switch 46 passes to inverter 310 through conductor 312which in turn issues a true signal to reset latch 314 through conductor316 and causes the output of latch 314 to AND gate 306 through conductor318 to return a false. The output of landing gear switch is received byAND gate 306. If the aircraft is in flight a false signal is receivedand successive flight transfer is blocked. Automatic transfer inhibit158 will issue a true signal to inverter 320 through conductor 244 whenthe automatic transfer inhibit has been activated. A true signal toinverter 320 will be passed to AND gate 306 as a false signal,preventing a true output by AND gate 306. Thus while automatic transferinhibit is issuing a true signal no landing gear switch transfer willtake place.

Referring now to FIG. 11, the interconnect logic 180 of automatictransfer circuit 34 and automatic transfer circuit 32 are shown indetail along with their interconnections. Since the internal connectionsof interconnect logic 180 of automatic transfer circuit 34 and theinterconnect logic of automatic transfer circuit 32 are identical, theconnections of interconnect logic 180 of automatic transfer circuit 34only will be described.

The input side of AND gate 344 is connected to on-off control 184through conductor 190 which is in turn connected to terminal 346 throughconductor 36d; it is also connected to terminal 348 and terminal 350through conductor 352, and to terminal 354 through conductor 356. Theoutput side of AND gate 344 is connected to OR gate 176 throughconductor 182.

The input side of AND gate 358 is connected to on-off control 184through conductor 188, to terminal 348 and terminal 350 throughconductor 360 and through inverter 362 to terminal 354. Terminal 354 ofautomatic transfer circuit 34 is connected to terminal 346 of automatictransfer circuit 32. The remaining external terminals of theinterconnect logic 180 of automatic transfer circuit 34 are unconnected.Terminal 348 and terminal 364 of the interconnect logic 180 of automatictransfer circuit 32 are connected to each other.

If automatic cabin pressure controller 16 and automatic cabin pressurecontroller 17 are either both on or both off, the interconnect logic 180will operate on automatic cabin pressure controller 17 throughinterconnect logic 180 of automatic transfer circuit 34 to turncontroller 17 on if both controllers were off or to turn controller 17off if both controllers were on. Change in status of controller 16 isprevented by the disabling connection between terminal 348 and terminal364 of automatic transfer circuit 32. By connecting terminal 348 toterminal 364, a false signal is input to AND gate 344 and AND gate 358of interconnect logic of automatic transfer circuit 32. Since each ofthe AND gates of interconnect logic of automatic transfer circuit 32will constantly have a false input, they will never have a true oroperative output and further discussion of their operation isunnecessary.

When automatic cabin pressure controller 17 is on, on-off control 184issues a true signal which passes to AND gate 344 through conductor 190.If automatic cabin pressure controller 16 is simultaneously on, on-offcontrol of automatic transfer circuit 32 will issue a true signal whichwill pass through terminal 346 of the interconnect logic of automatictransfer circuit 32 to terminal 354 of interconnect logic 180 ofautomatic transfer circuit 34. This true signal will pass to inverter362 and be input into AND gate 358 as a false and to AND gate 344through conductor 356 as a true signal. The third input to AND gate 344will be from terminal 350 or the power supply which will be a constanttrue input. Three true inputs at AND gate 344 will result in a trueoutput to OR gate 176 through conductor 182 and will turn automaticcabin pressure controller 17 off as described in connection with FIG. 9.

If automatic cabin pressure controller 17 is off, on-off control 184will issue a true signal to AND gate 358 through conductor 188. Ifautomatic cabin pressure controller 16 is off, on-off control ofautomatic transfer circuit 32 will be issuing a false signal to terminal346. This false signal will then pass to terminal 354 of interconnectlogic 180 of automatic transfer circuit 34 and pass to inverter 362which in turn will issue a true signal to AND gate 358. The false signalat terminal 354 is also passed to AND gate 344 through conductor 356which will keep the output at AND gate 344 false. The third input to ANDgate 358 is from terminal 350 which is a constant true signal throughconductor 360. The three true inputs to AND gate 358 will result in atrue output to OR gate 172 through conductor 220. A true signal at theinput to OR gate 172 will turn automatic cabin pressure controller 17 onas described in connection with FIG. 8.

The purpose of having identical interconnect logics in automatictransfer circuits 32 and 34 is to retain the complete interchangeabilityof the two units. Providing external terminals allows the disabling ofone interconnect logic while the other remains completely functional.

Specific embodiments of an aircraft cabin pressure control system havebeen shown, illustrating and describing the use of dual automaticcontrollers, a method for alternating their use in an aircraft, a methodfor achieving a linear rate of change of cabin pressure, a way ofidentifying the defective controller when it malfunctions, a method fordetermining whether an unexpected result was due to a controllermalfunction, methods for preventing both controllers from being in thesame state, a method for detecting undesirable rate changes in cabinpressure, and a method for preventing disasters due to the differentialbetween cabin pressure and outside ambient pressure. It is to beunderstood that the foregoing embodiments are presented by way ofexample only and that the invention is not to be construed as beinglimited thereto, but only by the proper scope of the following claims.

I claim:
 1. A cabin pressure control system for aircraft, said systemcomprising:controller means for regulating cabin pressure rate of changein a predetermined manner; relationship means for producing an outputrepresenting a relation of cabin pressure and external pressure; meansresponsive to said output for incrementing said cabin pressure rate ofchange when said output exceeds a preselected value; standby controllermeans; transfer means for monitoring performance of said controllermeans and including means for disconnecting said controller means andconnecting said standby controller means for regulating cabin pressurerate of change upon malfunction of said controller means; and meansresponsive to said output for preventing disconnection of saidcontroller means and connection of said standby controller means whensaid output exceeds said preselected value.
 2. A cabin pressure controlsystem according to claim 1 wherein said output means comprises:cabinpressure sensor means for producing a signal representing said cabinpressure; external pressure sensor means for producing a signalrepresenting said external pressure; and summming means for producing asignal representing the difference of said cabin pressure signal andsaid external pressure signal.
 3. A cabin pressure control systemaccording to claim 2 wherein said summing means includes:input meansrepresenting a predetermined difference of said cabin pressure signaland said external pressure signal.
 4. The cabin pressure control systemof claim 1 wherein said relationship means includes:cabin sensor meansresponsive to cabin pressure in the aircraft; ambient sensor meansresponsive to ambient atmospheric pressure; and output means forproducing an output responsive to said cabin sensor means and saidambient sensor means.
 5. The cabin pressure control system of claim 4wherein said output means includes:means for producing an outputresponsive to said cabin sensor means output and said ambient sensormeans output when a predetermined relation of said sensor means outputsis exceeded.
 6. A method for regulating aircraft cabin pressurecomprising the steps of:controlling the aircraft cabin pressure rate ofchange; producing an ambient response representative of externalpressure; producing a response representative of cabin pressure;combining said cabin response and said ambient response to produce aresultant response representative of the difference; and incrementingthe aircraft cabin pressure rate of change in response to the differencein excess of a predetermined level.
 7. In an automatic cabin pressurecontrol system in an aircraft, a cabin pressure control override systemcomprising:means to regulate cabin pressure rate of change; means fordetecting cabin pressure and producing a signal proportionate to thedetected cabin pressure; means for detecting ambient atmosphere pressureand producing a signal proportionate to the detected ambient atmospherepressure; means for subtracting the detected cabin pressure and thedetected atmosphere pressure and producing a signal representative ofthe difference; means for limiting said difference by a predeterminedvalue and producing a signal representative of the excess of saiddifference over the predetermined value; means for increasing saidexcess by multiples of itself and producing a signal proportional to themultiples of the excess; and increment means for increasing said cabinpressure rate of change by the multiple of the excess signal.
 8. A cabinpressure control override system of claim 7 wherein said means toregulate cabin pressure rate of change includes:flow control valvemeans; first controller means connected to said flow control valve meansfor controlling cabin pressure rate of change; second controller meansmonitoring the performance of said first controller means and responsiveto a malfunction of said first controller means; selective means forconnecting said second controller means to said flow control valve meansand disconnecting said first controller means in response to amalfunction of said first controller means; and means for inhibitingsaid selective means responsive to said increment means.